CVE-2026-57230OpenReplay: Authenticated ClickHouse SQL injection via session search
Updated under an hour ago ()
Does this affect you?
It affects openreplay. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
OpenReplay is a self-hosted session replay suite. Prior to 1.27.0, the session search and analytics API in enterprise editions with multi-tenancy enabled built ClickHouse queries by inserting user input into the query string, including two positions that took input without escaping, allowing an authenticated member to read any ClickHouse table through blind boolean and time-based exfiltration and to break the project's session search for all viewers until the stored key is removed. This issue is fixed in version 1.27.0.
- CVSS
- 5.4 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
- Weakness (CWE)
- CWE-89
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Jul 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
openreplay openreplay openreplay:openreplay (from the name) | before 1.27.0 | CNA record |
References
- https://github.com/openreplay/openreplay/security/advisories/GHSA-vxf8-j7jx-p65xx-refsource-confirm
- https://github.com/openreplay/openreplay/pull/4715x-refsource-misc
- https://github.com/openreplay/openreplay/commit/ae8de6893250dd41175c6b2d312545c515fa5a16x-refsource-misc
- https://github.com/openreplay/openreplay/releases/tag/v1.27.0x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.